Shared-service centres improve cost and consistency. They also concentrate postings under a handful of service accounts or pooled logins. When auditors ask who authorised a journal, “the Manila team” is not an answer that satisfies fieldwork.
Make identity travel with the entry
Where the ERP allows, require named user IDs even inside the hub, and map those IDs to employment records your Hong Kong controller can access. If the hub insists on a service account, pair it with a ticket number stored in a custom field — and retain the ticket system for the same period as the journal trail.
Watch for after-hours clusters
Hubs in other time zones create legitimate overnight postings. They also hide unusual activity inside normal hub hours. Continuous monitoring should tag hub-origin postings separately so a sudden spike is visible without treating every overnight entry as suspicious.
Contract the retention
Your shared-service agreement should state how long change logs are kept and how quickly exports are produced for Hong Kong statutory audits. Verbal assurances evaporate when the hub’s local IT policy rotates logs at ninety days.
Engagements that span hub-posted ledgers are a core part of our continuous monitoring work — thresholds and digests are written with hub patterns in mind from day one.